@fusengine/harness 0.1.90 → 0.1.92

package/src/runtime/confirm/confirm-gate.ts

@@ -0,0 +1,65 @@
+import type { Prompt } from "../../prompt/types";
+import { displayCodeForAction, hashForAction } from "./confirm-code";
+import { isIrreversible } from "./confirm-irreversible";
+import { recordPendingDeny } from "./confirm-pending";
+import { consumeConfirmToken } from "./confirm-state";
+import { authorizeCodexAction, codexAction } from "./codex-confirm";
+
+/**
+ * Harnesses where `respond.ts` silently downgrades `kind: "ask"` to a hard
+ * deny (Codex: `case "codex"`; Kimi: `toKimiResponse` maps `ask` to the same
+ * `permissionDecision:"deny"` envelope as `block`). Claude Code keeps native
+ * interactive `ask` — this mechanism NEVER applies there.
+ */
+const DEGRADES_ASK_TO_DENY: ReadonlySet<string> = new Set(["codex", "kimi"]);
+
+export type ConfirmVerdict = { allow: true } | { allow: false; prompt: Prompt };
+
+/**
+ * Whether/how a CONFIRM token changes an `ask` prompt about to be downgraded
+ * to a deny. Returns `null` when this mechanism doesn't apply AT ALL — any
+ * harness other than codex/kimi, any prompt kind other than `ask`, no
+ * command to key a hash off, or an irreversible command (G4) — in which case
+ * the caller's ORIGINAL prompt/response path runs completely unchanged. That
+ * `null` fast-path, hit on every claude-code call and every non-`ask` prompt,
+ * IS the non-regression property.
+ * @param id - Harness target id.
+ * @param prompt - The prompt `gate()` returned.
+ * @param command - `event.command` for the tool-use under judgment.
+ * @param sessionId - `event.sessionId`.
+ * @param now - Epoch ms.
+ * @param home - Test-only OS home override.
+ */
+export function confirmGate(
+  id: string,
+  prompt: Prompt,
+  command: string | undefined,
+  sessionId: string,
+  now: number,
+  home?: string,
+  codex?: Readonly<{ tool: string; cwd: string; toolUseId?: string }>,
+): ConfirmVerdict | null {
+  if (prompt.kind !== "ask" || !DEGRADES_ASK_TO_DENY.has(id) || !command || isIrreversible(command)) return null;
+  try {
+    if (id === "codex" && codex) {
+      const action = codexAction(codex.tool, codex.cwd, command, now);
+      if (!action) return null;
+      const verdict = authorizeCodexAction(sessionId, action, codex.toolUseId, now, home);
+      if (verdict.allow) return verdict;
+      const ruleId = prompt.ruleId ?? "policy:ask";
+      const diagnostic = `rule ID: ${ruleId}\ncanonical command: ${action.command}\nexpected token: CONFIRM ${action.code}\nrejection: ${verdict.reason}`;
+      return { allow: false, prompt: { ...prompt, reason: `${prompt.reason}\nPour autoriser, réponds : CONFIRM ${action.code}\n${diagnostic}` } };
+    }
+    const hash = hashForAction(command);
+    if (consumeConfirmToken(sessionId, hash, now, home)) return { allow: true };
+    const code = displayCodeForAction(command);
+    recordPendingDeny(sessionId, hash, code, now, home);
+    return { allow: false, prompt: { ...prompt, reason: `${prompt.reason}\nPour autoriser, réponds : CONFIRM ${code}` } };
+  } catch {
+    // A state-io failure (full disk, unwritable home) must fall back to the
+    // plain deny, never crash the hook — same invariant as confirm-submit.ts.
+    // The caller's `confirm ? confirm.prompt : prompt` treats `null` exactly
+    // like "mechanism doesn't apply", i.e. the pre-CONFIRM deny unchanged.
+    return null;
+  }
+}

package/src/runtime/confirm/confirm-irreversible.ts

@@ -0,0 +1,32 @@
+import { GIT_BLOCKED, matchPatterns } from "../../policy/patterns";
+
+/**
+ * A single flag token carrying BOTH `r` and `f` in either order (`-rf`,
+ * `-fr`, `-rfv`, …) — same lookahead technique as patterns.ts's
+ * `CLEAN_FD_FLAG`, reused here rather than re-derived (DRY).
+ */
+const RM_COMBINED_FLAG = /\s-(?=[a-zA-Z]*r)(?=[a-zA-Z]*f)[a-zA-Z]+(?:\s|=|$)/;
+/** Split flags `-r ... -f` (either order) within the SAME command segment (no `;&|` between). */
+const RM_SPLIT_FLAG = /\brm\b[^;&|\n]*\s-r\b[^;&|\n]*\s-f\b|\brm\b[^;&|\n]*\s-f\b[^;&|\n]*\s-r\b/;
+
+/**
+ * Generic `rm -rf`/`-fr` (ANY target, not just `/`/`~`) — deliberately
+ * broader than `src/codex-rules/rules/rm-variants.ts`'s root/system-path-only
+ * forbidden list: G4 must treat every recursive force-delete as
+ * never-confirmable, not only the ones aimed at a system path.
+ */
+function isRmRf(cmd: string): boolean {
+  return /\brm\b/.test(cmd) && (RM_COMBINED_FLAG.test(cmd) || RM_SPLIT_FLAG.test(cmd));
+}
+
+/**
+ * G4: commands NEVER unlockable by a CONFIRM token, regardless of a valid,
+ * fresh, correctly-scoped one. Reuses {@link GIT_BLOCKED} (push --force,
+ * reset --hard, clean -fd, branch -D, rebase --force — DRY, same list the
+ * rest of the policy already enforces) plus a generic `rm -rf` check.
+ * @param cmd - The command a prompt is about (empty/undefined = not irreversible).
+ */
+export function isIrreversible(cmd: string | undefined): boolean {
+  if (!cmd) return false;
+  return matchPatterns(cmd, GIT_BLOCKED) || isRmRf(cmd);
+}

package/src/runtime/confirm/confirm-pending.ts

@@ -0,0 +1,34 @@
+import { homedir } from "node:os";
+import { loadSessionState, saveSessionState, sanitizeSessionId } from "../home-state";
+
+/** The last `ask`-turned-deny for a session: its full hash plus the short code shown to the human. */
+export interface PendingDeny {
+  hash: string;
+  code: string;
+  ts: number;
+}
+
+/**
+ * Record the action a deny prompt just showed (overwrites any previous
+ * pending deny for this session — only the LAST blocked action can be
+ * confirmed). Pure bookkeeping, no gate: every ask-turned-deny records one,
+ * whether or not the user ever confirms it.
+ * @param sessionIdRaw - Raw session id from the payload.
+ * @param hash - Full {@link import("./confirm-code").hashForAction} of the command.
+ * @param code - The short display code shown alongside it.
+ * @param now - Epoch ms.
+ * @param home - Test-only OS home override.
+ */
+export function recordPendingDeny(sessionIdRaw: unknown, hash: string, code: string, now: number, home: string = homedir()): void {
+  const sid = sanitizeSessionId(sessionIdRaw);
+  if (!sid) return;
+  const state = loadSessionState(sid, home);
+  saveSessionState(sid, { ...state, pendingDeny: { hash, code, ts: now } satisfies PendingDeny }, home);
+}
+
+/** Read back the pending deny for a session (`undefined` when none/invalid session id). */
+export function getPendingDeny(sessionIdRaw: unknown, home: string = homedir()): PendingDeny | undefined {
+  const sid = sanitizeSessionId(sessionIdRaw);
+  if (!sid) return undefined;
+  return loadSessionState(sid, home).pendingDeny as PendingDeny | undefined;
+}

package/src/runtime/confirm/confirm-state.ts

@@ -0,0 +1,56 @@
+import { homedir } from "node:os";
+import { loadSessionState, saveSessionState, sanitizeSessionId } from "../home-state";
+import { isSubagentActive } from "./confirm-subagent";
+
+/** A posed confirmation token: the FULL action hash (G3) plus its mint timestamp (G2). */
+interface ConfirmToken {
+  hash: string;
+  ts: number;
+}
+
+/** Confirmation freshness window (G2) — 5 minutes, matches the validated prototype. */
+const TTL_MS = 5 * 60 * 1000;
+
+/**
+ * Pose a confirmation token for this session's pending action. No-op while
+ * {@link isSubagentActive} (G0, confirm-subagent.ts) — the sole gate that
+ * stops an agent, which always sees the display code in its own blocked tool
+ * result, from typing it back to self-approve.
+ */
+export function placeConfirmToken(sessionIdRaw: unknown, hash: string, now: number, home: string = homedir(), env: Record<string, string | undefined> = process.env): void {
+  const sid = sanitizeSessionId(sessionIdRaw);
+  if (!sid || isSubagentActive(sid, now, home, env)) return;
+  const state = loadSessionState(sid, home);
+  saveSessionState(sid, { ...state, confirmToken: { hash, ts: now } satisfies ConfirmToken }, home);
+}
+
+/** Invalidate any pending token for this session (G5: an explicit refusal). */
+export function dropConfirmToken(sessionIdRaw: unknown, home: string = homedir()): void {
+  const sid = sanitizeSessionId(sessionIdRaw);
+  if (!sid) return;
+  const state = loadSessionState(sid, home);
+  if (state.confirmToken === undefined) return;
+  const { confirmToken: _drop, ...rest } = state;
+  saveSessionState(sid, rest, home);
+}
+
+/**
+ * Consume a token that matches `hash` exactly (G3), whether or not it's
+ * fresh — a mismatched hash leaves the token untouched (it may still be
+ * valid for the action it actually confirms). G1 (one-shot) + G2 (5-min TTL)
+ * both apply only once the hash matches.
+ * @returns true = allow (token consumed); false = deny (nothing changed, or
+ * the matching token had expired and was dropped).
+ */
+export function consumeConfirmToken(sessionIdRaw: unknown, hash: string, now: number, home: string = homedir()): boolean {
+  const sid = sanitizeSessionId(sessionIdRaw);
+  if (!sid) return false;
+  const tok = loadSessionState(sid, home).confirmToken as ConfirmToken | undefined;
+  if (!tok || tok.hash !== hash) return false;
+  if (now - tok.ts > TTL_MS) {
+    dropConfirmToken(sid, home);
+    return false;
+  }
+  dropConfirmToken(sid, home);
+  return true;
+}

package/src/runtime/confirm/confirm-subagent.ts

@@ -0,0 +1,112 @@
+import { homedir } from "node:os";
+import { parseEnvInt } from "../../config/env";
+import { loadSessionState, saveSessionState, sanitizeSessionId } from "../home-state";
+
+/** Env var overriding the G0 cool-down window below (seconds). Unset = the 300s/5min default. */
+const CONFIRM_WINDOW_ENV_KEY = "FUSE_CONFIRM_SUBAGENT_WINDOW_SEC";
+/** Default G0 cool-down (seconds) when {@link CONFIRM_WINDOW_ENV_KEY} is unset/invalid — 300s (5min). */
+const DEFAULT_CONFIRM_WINDOW_SEC = 300;
+
+/**
+ * G0 cool-down after the last SubagentStart/SubagentStop seen for this
+ * session — {@link DEFAULT_CONFIRM_WINDOW_SEC} by default, overridable via
+ * `FUSE_CONFIRM_SUBAGENT_WINDOW_SEC` (seconds) without a rebuild. Read this
+ * doc before ever touching this value: it is NOT G0's primary protection,
+ * and it is not sized to "safely cover a sub-agent's whole runtime".
+ *
+ * G0's PRIMARY protection is P0, measured live under Codex in a prior
+ * session: a sub-agent never receives its own `UserPromptSubmit` — only a
+ * human typing into the top-level session does — so a sub-agent is
+ * STRUCTURALLY unable to place a CONFIRM token at all, regardless of this
+ * window's value. This timestamp is a SECOND belt, covering only the
+ * residual case where that structural property does not hold on some future
+ * harness (Kimi: not yet measured either way).
+ *
+ * The default is a deliberate, owner-decided trade-off between over-refusal
+ * and usability, NOT a safety-maximizing constant: sub-agents in this
+ * ecosystem share the lead session's `session_id`, and the owner runs
+ * sub-agents continuously — an earlier 30-minute window froze CONFIRM for
+ * the entire session on every single sub-agent call, which neutralizes the
+ * feature it protects (a guard that disables what it guards is not a good
+ * guard). 5 minutes comfortably covers the case that actually matters — a
+ * sub-agent genuinely in flight at the exact moment a human types a CONFIRM
+ * code — without pinning a busy session shut. Do not read this value as "the
+ * time G0 needs to be safe" — that safety comes from P0.
+ *
+ * This deliberately reuses {@link parseEnvInt} (`src/config/env.ts`) rather
+ * than `resolveTtlSec`/`FUSE_ENFORCE_TTL_SEC` (`src/config/ttl.ts`): that TTL
+ * governs APEX evidence freshness (120s default) — an unrelated concern
+ * accidentally coupling the two would make lengthening the research-evidence
+ * window also lengthen the confirmation cool-down. `resolveTtlSec` also
+ * hardcodes its own fallback (`DEFAULT_TTL_SEC` = 120) regardless of which
+ * env key is passed, so it cannot express a 300s default either — this key
+ * gets its OWN env var and its OWN default via the same underlying
+ * `parseEnvInt` primitive, with no new parsing logic.
+ *
+ * Mechanically this is still a single monotone "last seen" timestamp, NOT a
+ * start/stop pair — a symmetric increment/decrement depth counter was tried
+ * and rejected: the harness dispatches ONE real SubagentStart/SubagentStop
+ * through MULTIPLE concurrent sibling plugin processes (the repo's own
+ * "~11-process multi-plugin fan-out"), all doing UNLOCKED read-modify-write
+ * on the same session-state file — a duplicated decrement can walk the
+ * counter to 0 while a sub-agent is still running, and G0 would then wrongly
+ * OPEN. Two ever-growing `starts`/`stops` counters were also rejected: if the
+ * fan-out dispatches SubagentStart via N processes and SubagentStop via
+ * M ≠ N, `starts > stops` stays true FOREVER and the session is frozen for
+ * good — worse than any window.
+ *
+ * `Math.max(prevSeenAt, now)` avoids both failure modes: an LWW
+ * (last-writer-wins) register merged with `max`, which is idempotent,
+ * commutative, and associative — under ANY interleaving of concurrent
+ * writers (lost updates included), the stored value converges to the
+ * largest `now` any writer supplied, and every writer's `now` is a real
+ * wall-clock read taken within milliseconds of the true event, so it can
+ * never regress below a timestamp it already held. BOTH SubagentStart and
+ * SubagentStop bump the SAME field this way — there is no decrement
+ * anywhere in this file, so there is nothing for a duplicated event to
+ * desynchronize; the flag falls only once this window elapses with no
+ * further sighting.
+ * @param env - Env map to resolve the override from (defaults to `process.env`; tests inject a plain object).
+ */
+function subagentWindowMs(env: Record<string, string | undefined> = process.env): number {
+  return parseEnvInt(env[CONFIRM_WINDOW_ENV_KEY], DEFAULT_CONFIRM_WINDOW_SEC) * 1000;
+}
+
+/**
+ * G0: true within {@link subagentWindowMs} of the last SubagentStart/
+ * SubagentStop seen for this session. An invalid/missing session id is
+ * treated as active too — fail-closed, never pose a token when in doubt.
+ */
+export function isSubagentActive(sessionIdRaw: unknown, now: number, home: string = homedir(), env: Record<string, string | undefined> = process.env): boolean {
+  const sid = sanitizeSessionId(sessionIdRaw);
+  if (!sid) return true;
+  const seenAt = loadSessionState(sid, home).subagentSeenAt;
+  return typeof seenAt === "number" && now - seenAt < subagentWindowMs(env);
+}
+
+/**
+ * Record a SubagentStart OR SubagentStop sighting for this session as a
+ * monotone max-write (see {@link subagentWindowMs}'s doc for why this can
+ * never desync unsafely under concurrent racy writers). Both events call
+ * this the SAME way — there is no separate "clear" path.
+ *
+ * Called unconditionally, BEFORE scope branching, on every SubagentStart/Stop
+ * across every plugin (dispatch.ts) — never allowed to throw: a disk fault
+ * here (full disk, unwritable home) must degrade to "sighting not recorded",
+ * never crash sub-agent lifecycle dispatch for scopes that have nothing to do
+ * with CONFIRM. Safe to swallow: G0's PRIMARY protection is P0 (a sub-agent
+ * structurally never receives its own UserPromptSubmit, confirm-gate.ts's
+ * doc) — this window is only a second belt, so losing one sighting degrades
+ * that belt, it does not open the gate.
+ */
+export function markSubagentSeen(sessionIdRaw: unknown, now: number, home: string = homedir()): void {
+  try {
+    const sid = sanitizeSessionId(sessionIdRaw);
+    if (!sid) return;
+    const state = loadSessionState(sid, home);
+    const prev = typeof state.subagentSeenAt === "number" ? state.subagentSeenAt : 0;
+    saveSessionState(sid, { ...state, subagentSeenAt: Math.max(prev, now) }, home);
+  } catch {
+    // A state-io failure must never break the hook (same invariant as confirm-submit.ts).
+  }
+}

package/src/runtime/confirm/confirm-submit.ts

@@ -0,0 +1,38 @@
+import { getPendingDeny } from "./confirm-pending";
+import { dropConfirmToken, placeConfirmToken } from "./confirm-state";
+
+/** Common explicit-refusal words (fr/en), any of which invalidates a pending token (G5). */
+const REFUSAL_RE = /\b(non|no|stop|annule|cancel|abort|nope|laisse tomber|pas maintenant)\b/i;
+/** `CONFIRM <4-hex-chars>`, case-insensitive, tolerant of `confirm4f2a` / `Confirm-4f2a` / `confirm_4f2a`. */
+const CONFIRM_RE = /confirm[\s_-]*([0-9a-f]{4})\b/i;
+
+/**
+ * Parse a submitted user prompt for `CONFIRM <code>` or an explicit refusal.
+ * A refusal always wins (checked first) and drops any pending token (G5),
+ * even if the same text also happens to contain a code. A confirm only
+ * places a token when its 4-char code matches this session's LAST pending
+ * deny (see confirm-pending.ts) — the code is looked up back to the full
+ * hash that deny recorded, never compared as a code-to-code match (that
+ * would reopen the collision {@link import("./confirm-code").displayCodeForAction}
+ * warns about). Never throws — this runs inside a hook.
+ * @param sessionId - The normalized event's session id.
+ * @param text - The prompt text ({@link import("../prompt-text").promptText} output).
+ * @param now - Epoch ms.
+ * @param home - Test-only OS home override.
+ */
+export function handleConfirmSubmit(sessionId: string, text: string, now: number, home?: string): void {
+  try {
+    if (REFUSAL_RE.test(text)) {
+      dropConfirmToken(sessionId, home);
+      return;
+    }
+    const m = text.match(CONFIRM_RE);
+    const typedCode = m?.[1];
+    if (!typedCode) return;
+    const pending = getPendingDeny(sessionId, home);
+    if (!pending || pending.code.toLowerCase() !== typedCode.toLowerCase()) return;
+    placeConfirmToken(sessionId, pending.hash, now, home); // G0 enforced inside
+  } catch {
+    // A state-io failure must never break the hook.
+  }
+}

package/src/runtime/core-guards-active.ts

@@ -0,0 +1,84 @@
+/**
+ * Per-harness ACTIVATION probing for the core-guards plugin, behind
+ * {@link coreGuardsWired}. The owner decision: the solid scope abstains from
+ * its file-size deny ONLY when core-guards is installed AND active — an
+ * installed-but-disabled plugin must leave the solid deny firing. Safe
+ * default, per harness: anything undetectable (unreadable/missing state)
+ * reads as NOT active, so the worst case is a duplicate deny — never zero.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+/** File content, or null when unreadable (undetectable → caller's safe default). */
+function readText(path: string): string | null {
+  try { return readFileSync(path, "utf8"); } catch { return null; }
+}
+
+/** First `core-guards@…` value in a name→bool map; undefined when absent. */
+function enabledEntry(map: unknown): boolean | undefined {
+  if (typeof map !== "object" || map === null || Array.isArray(map)) return undefined;
+  for (const [k, v] of Object.entries(map as Record<string, unknown>)) {
+    if (k.startsWith("core-guards@")) return v !== false;
+  }
+  return undefined;
+}
+
+/**
+ * Claude Code: `~/.claude/settings.json` → `enabledPlugins`. core-guards is a
+ * REQUIRED marketplace plugin: no entry means active whenever the marketplace
+ * copy exists (`installed`); an explicit `false` means disabled. Unreadable
+ * settings → false (undetectable).
+ * @param home - OS home.
+ * @param installed - Whether the marketplace copy of core-guards exists.
+ */
+export function claudeCoreGuardsActive(home: string, installed: boolean): boolean {
+  const text = readText(join(home, ".claude", "settings.json"));
+  if (text === null) return false;
+  try {
+    const entry = enabledEntry((JSON.parse(text) as { enabledPlugins?: unknown }).enabledPlugins);
+    return entry ?? installed;
+  } catch { return false; }
+}
+
+/**
+ * Codex: `[plugins."core-guards@<mkt>"] enabled = …` in `~/.codex/config.toml`
+ * (minimal section-scoped extraction — no TOML dependency). Missing section,
+ * `enabled = false`, or unreadable file → false.
+ * @param home - OS home.
+ */
+export function codexCoreGuardsActive(home: string): boolean {
+  const text = readText(join(home, ".codex", "config.toml"));
+  if (text === null) return false;
+  // `^` + `m`: the header must start a real line — an inert one-line comment
+  // like `# [plugins."core-guards@mkt"] enabled = true` must never match
+  // (verified: without the anchor it does, flipping this to a false "active"
+  // and silencing the solid file-size deny — the owner's "never zero deny").
+  const m = /^\[plugins\."core-guards@[^"]+"\]\s*enabled\s*=\s*(true|false)/m.exec(text);
+  return m?.[1] === "true";
+}
+
+/**
+ * Kimi: `<KIMI_CODE_HOME>/plugins/installed.json` — map form (`id →
+ * {enabled?}`) or array form (`[{id, enabled?}]`); an entry counts active
+ * unless `enabled === false`. File absent here today → format read
+ * tolerantly; missing/unreadable → false (undetectable).
+ * @param root - Kimi data root (`KIMI_CODE_HOME` ?? `~/.kimi-code`).
+ */
+export function kimiCoreGuardsActive(root: string): boolean {
+  const text = readText(join(root, "plugins", "installed.json"));
+  if (text === null) return false;
+  try {
+    const data = (JSON.parse(text) as { plugins?: unknown }).plugins;
+    if (Array.isArray(data)) {
+      const hit = data.find((p) => typeof p === "object" && p !== null && (p as { id?: unknown }).id === "core-guards");
+      return hit !== undefined && (hit as { enabled?: unknown }).enabled !== false;
+    }
+    if (typeof data !== "object" || data === null) return false;
+    for (const [k, v] of Object.entries(data as Record<string, unknown>)) {
+      if (k === "core-guards" || k.startsWith("core-guards@")) {
+        return typeof v === "object" && v !== null ? (v as { enabled?: unknown }).enabled !== false : v !== false;
+      }
+    }
+    return false;
+  } catch { return false; }
+}

package/src/runtime/core-guards-wired.ts

@@ -0,0 +1,47 @@
+/**
+ * Detect whether the core-guards plugin is installed AND ACTIVE for a harness.
+ * When it is, its `core` scope already owns the PreToolUse file-size deny
+ * (`policy/evaluate.ts`), so the `solid` scope MUST abstain on the same
+ * tool-call — otherwise a user with BOTH plugins wired on PreToolUse
+ * Write|Edit receives the identical deny twice. Activation probing is
+ * per-harness (`core-guards-active.ts`, owner decision):
+ * - claude-code: marketplace copy present + `settings.json` `enabledPlugins`
+ *   (required core: no entry = active; explicit `false` = disabled);
+ * - codex: `[plugins."core-guards@…"] enabled = true` in `~/.codex/config.toml`;
+ * - kimi: `<KIMI_CODE_HOME>/plugins/installed.json` entry not disabled.
+ * SAFE DEFAULT: anything undetectable (unreadable/missing state) reads as
+ * NOT active — the solid scope then fires its own deny, so the worst case is
+ * a duplicate deny, NEVER zero deny.
+ */
+import { existsSync, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { claudeCoreGuardsActive, codexCoreGuardsActive, kimiCoreGuardsActive } from "./core-guards-active";
+
+/** Immediate child dir names of `dir`, or [] when unreadable. */
+function children(dir: string): string[] {
+  try { return readdirSync(dir); } catch { return []; }
+}
+
+/** Claude: marketplace copy `~/.claude/plugins/marketplaces/<m>/plugins/core-guards`. */
+function claudeInstalled(home: string): boolean {
+  const markets = join(home, ".claude", "plugins", "marketplaces");
+  return children(markets).some((m) => existsSync(join(markets, m, "plugins", "core-guards")));
+}
+
+/**
+ * True when core-guards is installed AND active for the harness.
+ * @param id - Harness id.
+ * @param env - Environment (defaults to `process.env`).
+ * @param home - OS home (defaults to `env.HOME` / `os.homedir()`; injectable).
+ */
+export function coreGuardsWired(
+  id: string,
+  env: Record<string, string | undefined> = process.env,
+  home: string = env.HOME ?? homedir(),
+): boolean {
+  if (id === "claude-code") return claudeCoreGuardsActive(home, claudeInstalled(home));
+  if (id === "codex") return codexCoreGuardsActive(home);
+  if (id === "kimi") return kimiCoreGuardsActive(env.KIMI_CODE_HOME ?? join(home, ".kimi-code"));
+  return false;
+}

package/src/runtime/deny-loop-store.ts

@@ -0,0 +1,94 @@
+/**
+ * @module deny-loop-store
+ * Sidecar state + gate wiring for the mechanical anti-loop ({@link module:deny-loop}).
+ *
+ * STATE — a standalone sidecar (`deny-loop.json`) in the same per-project state
+ * dir as the session track, NOT a field in `session-state.ts`: that file is owned
+ * by another concern this batch, so a shared field would couple two owners and
+ * contend on one file for two unrelated maps. This mirrors the proven
+ * {@link module:inject-dedup} `oncePerWindow` sidecar (atomicWrite, prune-by-window,
+ * fail-open) and keeps the anti-loop self-contained.
+ *
+ * WINDOW — the hash expires with the same freshness window the gate already uses
+ * (`FUSE_ENFORCE_TTL_SEC` / `windowMs`): a loop is a burst, not a lifetime, so a
+ * stale deny past the window resets and a later identical call is a fresh #1.
+ * @packageDocumentation
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { atomicWrite } from "../util/json-io";
+import { denyHash, denyLoopCheck, enrichRepeatDeny, type DenyEntry, type DenyLoopResult } from "../policy/deny-loop";
+import { BURST_DEDUP_MS } from "./burst-window";
+import type { Prompt } from "../prompt/types";
+
+/** Sidecar basename under the per-project state dir. */
+const SIDECAR = "deny-loop.json";
+
+/**
+ * Injected clock + state dir + expiry window (no env var; the gate supplies all
+ * three). `sessionId` — when present — scopes the map key AND arms the burst
+ * dedup ({@link module:burst-window}) so the ~11 sibling plugin hooks of ONE
+ * event count once, not once each; two sessions never share a counter. Omitted
+ * by mono-process callers/tests → historical per-hash, no-dedup behaviour.
+ */
+export interface DenyLoopOpts { now: number; dir: string; windowMs: number; sessionId?: string; }
+
+/** Load the `{ hash -> DenyEntry }` map, or `{}` when missing/corrupt. */
+function loadMap(path: string): Record<string, DenyEntry> {
+  try {
+    if (!existsSync(path)) return {};
+    const data: unknown = JSON.parse(readFileSync(path, "utf8"));
+    return data && typeof data === "object" && !Array.isArray(data) ? (data as Record<string, DenyEntry>) : {};
+  } catch {
+    return {};
+  }
+}
+
+/** Drop entries whose last deny is older than the window (bounds size + resets stale loops). */
+function prune(map: Record<string, DenyEntry>, now: number, windowMs: number): Record<string, DenyEntry> {
+  const out: Record<string, DenyEntry> = {};
+  for (const [k, e] of Object.entries(map)) {
+    if (e && typeof e.lastTs === "number" && now - e.lastTs < windowMs) out[k] = e;
+  }
+  return out;
+}
+
+/**
+ * Record a deny for `(tool, input)`: prune, {@link denyLoopCheck}, persist the
+ * bumped entry. Fails open (`isRepeat:false`) when the sidecar is unwritable — a
+ * broken state dir must never manufacture a false `[REPEAT]`.
+ * @param tool - Tool name.
+ * @param input - Identifying tool input.
+ * @param opts - Clock + state dir + window.
+ * @returns `{ isRepeat, count, hash }`.
+ */
+export function recordDeny(tool: string, input: Record<string, unknown>, opts: DenyLoopOpts): DenyLoopResult {
+  const hash = denyHash(tool, input);
+  const sid = opts.sessionId?.trim();
+  const key = sid ? `${hash}::${sid}` : hash;
+  const path = join(opts.dir, SIDECAR);
+  const map = prune(loadMap(path), opts.now, opts.windowMs);
+  const res = denyLoopCheck(key, map, { now: opts.now, windowMs: opts.windowMs, dedupMs: sid ? BURST_DEDUP_MS : 0 });
+  if (!res.deduped) {
+    map[key] = { count: res.count, lastTs: opts.now };
+    try { atomicWrite(path, JSON.stringify(map)); } catch { /* fail-open: never fabricate a repeat */ }
+  }
+  return { ...res, hash };
+}
+
+/**
+ * Gate tail: record every block deny; on a repeat, return the enriched prompt.
+ * Allows (`null`) and non-block prompts (`ask`/`inform`) pass through untouched —
+ * a loop is a retried REFUSAL, and only `block` is a refusal. The decision is
+ * NEVER changed; only a repeated block's message is rewritten.
+ * @param prompt - The gate's outcome.
+ * @param tool - Tool name.
+ * @param input - Identifying tool input.
+ * @param opts - Clock + state dir + window.
+ * @returns The prompt, enriched only when it is a repeated block.
+ */
+export function withDenyLoop(prompt: Prompt | null, tool: string, input: Record<string, unknown>, opts: DenyLoopOpts): Prompt | null {
+  if (!prompt || prompt.kind !== "block") return prompt;
+  const { isRepeat, count } = recordDeny(tool, input, opts);
+  return isRepeat ? enrichRepeatDeny(prompt, count) : prompt;
+}

package/src/runtime/deny-notice.ts

@@ -0,0 +1,52 @@
+/**
+ * @module deny-notice
+ * Attach a user-visible notice to a deny/ask hook response — the owner-reported
+ * gap where `permissionDecision: deny/ask` (the agent-only channel) left the
+ * human staring at a silent terminal. Mirrors {@link module:notices}'s
+ * compliance notices but for the BLOCKING outcomes those never covered.
+ * @packageDocumentation
+ */
+import figures from "figures";
+import type { Prompt } from "../prompt/types";
+import { attachSystemMessage } from "../adapters/claude";
+import { onceExclusive } from "./inject-dedup";
+import { BURST_DEDUP_MS } from "./burst-window";
+
+/**
+ * The human-facing line for a block/ask outcome: the gate's own
+ * {@link Prompt.userMessage} when it set one, else a generic symbol + title —
+ * text-presentation Unicode only (`figures.cross`/`?`), never emoji: terminal-safe,
+ * single-cell width, with the Windows fallbacks `figures` already resolves, matching
+ * the existing notice family (`notices.ts`'s `✓`/`⚠`, left untouched by this module).
+ * Null for `inform` ({@link module:respond}'s own `userMessage` path already
+ * covers it) or when neither applies.
+ */
+export function denyAskNotice(prompt: Prompt): string | null {
+  if (prompt.kind === "block") return prompt.userMessage ?? `${figures.cross} ${prompt.title}`;
+  if (prompt.kind === "ask") return prompt.userMessage ?? `? ${prompt.title}`;
+  return null;
+}
+
+/**
+ * Attach {@link denyAskNotice} onto an already-rendered deny/ask `stdout`, for
+ * the harnesses whose human channel is `systemMessage` (claude-code/codex —
+ * `permissionDecision`/`permissionDecisionReason` stay byte-intact, only the
+ * top-level field is added). Every other harness passes `stdout` through
+ * unchanged: Cursor already emits `user_message` natively (respond.ts), Hermes
+ * and cline have no human channel. Deduped via {@link onceExclusive} against
+ * the ~11 sibling-plugin fan-out for one real event (same window as the
+ * sniper reminder / compliance notices).
+ * @param id - Harness id (`ctx.id` from `PreContext`).
+ * @param stdout - The rendered hook response (from {@link module:respond.respond}).
+ * @param prompt - The {@link Prompt} that produced `stdout`.
+ * @param sessionId - Current session id (dedup scope).
+ * @param dir - State-dir for the dedup marker (per-project state dir).
+ * @param now - Event clock (tests pass a fake one).
+ */
+export function withDenyNotice(id: string, stdout: string, prompt: Prompt, sessionId: string, dir: string, now?: number): string {
+  if (id !== "claude-code" && id !== "codex") return stdout;
+  const notice = denyAskNotice(prompt);
+  if (!notice) return stdout;
+  if (!onceExclusive(`deny-notice:${sessionId}:${prompt.title}`, BURST_DEDUP_MS, { now, dir })) return stdout;
+  return attachSystemMessage(stdout, notice);
+}